What this is
What is a visitor log?
What is a visitor log?
The record of who is on site who is not an employee or an inducted contractor, capturing arrival, departure, host and purpose, and supporting emergency accountability and site security.
Why does departure matter more than arrival?
Because arrival is easy to capture and tells you nothing during an emergency. A log that records arrivals produces a list of people who may or may not still be present, and acting on it means searching a building for people who have gone home.
Scope
When is a visitor log required?
This records presence. The induction and the access decision sit separately.
Use this template when
- Recording arrival and departure of visitors, including delivery drivers entering beyond a defined boundary
- Supporting emergency roll call and accountability
- Evidencing access control where it forms part of a food defense mitigation strategy
- Establishing who was on site at a given time, for security or investigation purposes
- Identifying the host responsible for each visitor
Do not use it for
- Visitor induction, which delivers the safety briefing
- Site access authorisation, determining which areas a person may enter
- Contractor management, which covers people performing work rather than visiting
- The food defense plan, which this record supports at specific process steps
- Security incident reporting, which records events rather than presence
Compliance mapping
Which FSMA Intentional Adulteration rule requirements does this satisfy?
Visitor records sit across emergency planning, food defense and privacy obligations.
| Clause | Requirement | Where it lands |
|---|---|---|
| 29 CFR 1910.38(c)(4) | Procedures to account for all employees and others after evacuation is complete | Day summary |
| 21 CFR Part 121 | Access control as a mitigation strategy where visitor access reaches actionable process steps | Related records |
| ISO 45001 cl.8.2 | Emergency preparedness and response covering everyone on the premises | Day summary |
| ISO 45001 cl.7.3 | Awareness for persons under the organisation's control, including visitors | Visitors |
| ISO 27001 A.7 | Physical entry controls including visitor registration and supervision | Visitors |
| GFSI schemes | Site security and visitor control including access to production areas | Related records |
| GDPR / privacy law | Visitor records are personal data requiring a defined retention period and lawful basis | Header |
| RRFSO art.9 (GB) | Fire risk assessment covering relevant persons, which includes visitors | Day summary |
What it does not cover
- Visitor induction, delivering the safety briefing on arrival.
- Site access authorisation, determining which areas may be entered.
- Contractor management, covering people performing work.
- The food defense plan, which this record supports at specific steps.
- Security incident reporting, recording events rather than presence.
How to complete it
How to complete a visitor log, step by step
Capture both directions, name a host, and test it during a drill.
Either record leaving as reliably as arriving, through access control at both directions, or remove the dependency by assigning host accountability. A sign-out column relies on people choosing to stop at a desk they have no reason to stop at, and it fails silently every day.
A specific employee, recorded by name, who knows where their visitor is and accounts for them at the assembly point. This is the single most effective element of visitor management, it costs nothing, and it converts an unanswerable question into a person who knows the answer.
Where visitor access reaches an actionable process step, access control may be a mitigation strategy under the Intentional Adulteration rule. That makes the log part of a regulated plan with monitoring and verification requirements, rather than a reception courtesy.
Visitor logs are personal data. Most are retained indefinitely because nobody decided otherwise, which creates an obligation nobody is managing. Setting a period appropriate to the purpose, and applying it, is straightforward and routinely absent.
What auditors find
Most common visitor log findings
Visitor log findings concentrate on departures and on what the log is for.
| Finding | Clause | What fixes it |
|---|---|---|
| Departures not reliably captured, so no roll call is possible. | 1910.38(c)(4) | Capture both directions or assign host accountability. |
| No named host, so nobody knows where a visitor is. | ISO 45001 cl.8.2 | Assign by name; it is the most effective control and costs nothing. |
| Paper book at an unstaffed reception outside working hours. | 1910.38(c)(4) | Out of hours is when contractor-heavy activity occurs and reception is closed. |
| Visitors entering production areas unescorted. | 21 CFR Part 121 | Escort in restricted areas; unaccompanied access defeats hygiene and defense controls. |
| Log not used during drills, so the gap is never found. | ISO 45001 cl.8.2 | Run a drill with visitors present and time the answer. |
| Delivery drivers entering beyond the yard without being logged. | ISO 45001 cl.7.3 | Set the boundary explicitly; the ambiguous middle is where people end up unlogged. |
| No retention period set for personal data. | GDPR | Visitor records are personal data; indefinite retention is an unmanaged obligation. |
| Access control not identified as a mitigation strategy where it functions as one. | 21 CFR Part 121 | Where it protects an actionable process step it carries monitoring and verification requirements. |
| Contractors logged as visitors rather than inducted. | ISO 45001 cl.8.1.4 | People performing work need full induction; distinguish at arrival. |
| Log not accessible at the assembly point during an evacuation. | 1910.38(c)(4) | A record inside the building being evacuated is not available when needed. |
Case in point
Case in point: the answer that took twenty minutes
A site ran an evacuation drill on a day with visitors present, deliberately, having never done so before. Employees assembled and were accounted for in under five minutes using the departmental roll call.
The visitor book listed nine names. Six people were at the assembly point. Establishing what had happened to the other three took just over twenty minutes: one had left after a morning meeting, one was with a host who had taken them out to a different building, and one had signed in with a company name and an illegible signature and could not be identified at all.
In a real evacuation the site would have had three unaccounted names, one of them unidentifiable, and a fire officer asking whether the building was clear.
The template
The template, field by field
The form exactly as it installs. Every field, option, score and conditional rule is editable, and the links to other templates come with it.
4 sections
- Reference
- OPS-029
- Archetype
- Log
- Record ID
- VIS2-2026-000
- Scoring
- Visitors accounted for
- Direction
- High is good
- Singleton
- Yes
- Basis
- FSMA Intentional Adulteration rule
- Links
- Links Visitor Induction and Evacuation Drill
- Tags
- Access, Visitor
- Sections
- 4
- Fields
- 37
- Follow up fields
- 3
- Repeating sections
- 1
- Links out
- 5
Header
7 fieldsLog ID*
Auto sequence. Format VIS2-2026-000.
The record's own ID. Other templates point at this value.
Status*
Drives who this goes to next.
- Planned2 pts
- In progress2 pts
- Complete3 pts
- Deferred0 pts
- Open0 pts
- Closed3 pts
- Overdue0 pts
Date*
Reception*
Site*
Site ID*
Format SITE-000.
Links to FDN-001 Site ID
What The Warden Holds During An Evacuation
The visitor log is a safety document before it is a security one. If it is a paper book at a desk nobody can carry to the muster point, it does neither job.
Visitors
Repeats15 fieldsVisitor Name*
Company
Host*
Time In*
Time Out
Still On Site*
- Yes2 pts
- No0 pts
- N/Aexcluded from denominator
Purpose*
Areas To Be Visited
Identity Checked*
- Yes2 pts
- No0 pts
- N/Aexcluded from denominator
Induction Given*
- Yes2 pts
- No0 pts
- N/Aexcluded from denominator
Induction ID
Links to TRN-008 Induction ID
Badge Issued And Worn*
- Yes2 pts
- No0 pts
- N/Aexcluded from denominator
Escorted*
- Yes2 pts
- No0 pts
- N/Aexcluded from denominator
PPE Issued Where Required
- Yes2 pts
- No0 pts
- N/Aexcluded from denominator
Badge Returned
- Yes2 pts
- No0 pts
- N/Aexcluded from denominator
Related records
1 fieldAccess Request ID
Where a visitor needed more than escorted access.
Links to OPS-028 Request ID
Day summary
14 fieldsVisitors Received*
Still On Site At Close*
Badges Not Returned*
Log Accessible At The Muster Point*
- Yes2 pts
- No0 pts
- N/Aexcluded from denominator
Anybody Unaccounted For At A Drill*
- Yes2 pts
- No0 pts
- N/Aexcluded from denominator
Drill Record ID
Links to SAF-068 Drill ID
Action Required*
Raise the action record, then enter its reference here.
- No2 pts
- Yes0 pts
Priority
- High0 pts
- Medium1 pt
- Low3 pts
CAPA ID
Format CAPA-2026-00000.
Links to FDN-014 CAPA ID
Action Owner
Reception*
Signature*
Security*
Second Signature*
OPS-029 · record IDs look like VIS2-2026-000 · Links Visitor Induction and Evacuation Drill
Open in KnowellaRun it with agents
From a document you fill in to a programme that runs itself
The log answers who is present. What fails is the departure nobody captured and the drill that never included visitors.
Captures arrival and departure with a named host, and makes the current presence list available at the assembly point rather than inside the building.
Distinguishes visitors from people performing work at arrival, routing the second to full induction.
Connects visitor access control to the food defense plan where it protects an actionable process step.
Includes visitors in drill accountability and records how long a definitive answer took, which is the measure that matters.
This template lives in KnowOps — frontline execution. Shift handover, production control, daily management, worker lifecycle and improvement.
Meet KnowOps→Glossary
Visitor Log definitions and key terms
- Roll call
- Accounting for everyone after evacuation, requiring knowledge of who is currently present rather than who arrived.
- Host accountability
- An arrangement making a named employee responsible for their visitor, including at the assembly point.
- Actionable process step
- Under the Intentional Adulteration rule, a point where a significant vulnerability exists and mitigation applies.
- Mitigation strategy
- A measure applied at an actionable process step, with monitoring and verification requirements attached.
- Escorted access
- Requiring accompaniment in defined areas, effective only where the escort remains present.
- Boundary definition
- The point beyond which someone must be logged and inducted, which needs stating explicitly.
- Retention period
- How long visitor records are kept, required because they constitute personal data.
- Assembly point availability
- Whether the record can be read during an evacuation, which a system inside the building cannot.
FAQ
Frequently asked questions about visitor log
What is the visitor log actually for?+
Answering who is inside the building right now, during an evacuation. Everything else it does is secondary. A log recording arrivals produces a list of people who may or may not still be present, and acting on it means sending marshals back into a building to look for people who left hours earlier.
Why does sign-out fail?+
Because leaving is unstructured. Arrival has a natural pause at a desk; departure does not. People leave with their host through another door, leave when a meeting overruns, or walk to a car park past a desk they have no reason to approach. The column exists and is not used, which is worse than not having it because it looks like a control.
What is the simplest fix?+
Host accountability. Each visitor is the named responsibility of an employee who knows where they are and accounts for them at the assembly point. It requires no technology, works during a power failure, survives an evacuation of the building containing the system, and produces a person who knows the answer rather than a list that might.
Does the log form part of food defense?+
It can. Under the Intentional Adulteration rule, access control may be a mitigation strategy where visitor access reaches an actionable process step, which brings monitoring, corrective action and verification requirements. Where that applies, the log is part of a regulated plan rather than a reception formality.
How do we know whether ours works?+
Run a drill on a day when visitors are on site and time how long it takes to reach a definitive answer about every one of them. Most sites have never done this, because drills are scheduled on convenient days and visitors are not part of the count. It is one afternoon and it tests the element most likely to fail.
Keep going
Related templates and programmes
Industries this is written for
Programmes this belongs to
Used together in Site Access and Facilities
Key and Access Device Register
Holds every key, fob and access device, who has it and what it opens
Access Request Record
Requests and approves access for a person to an area or a system, with the justification and an end date
PPE and Locker Issue Record
Records what personal equipment was issued to whom, in what size, and when it is due for replacement
Facility Service Request
Raises a request for a building or facility issue that is not a maintenance work order: lighting, heating, welfare, cleaning or fabric
Temporary Works Approval
Approves a temporary structure, support, barrier or arrangement, with who designed it and when it comes down
Access Control Review
Reviews who holds access to which areas and whether that is still justified
More in Site Access and Facilities
Access Request Record
Requests and approves access for a person to an area or a system, with the justification and an end date
PPE and Locker Issue Record
Records what personal equipment was issued to whom, in what size, and when it is due for replacement
Facility Service Request
Raises a request for a building or facility issue that is not a maintenance work order: lighting, heating, welfare, cleaning or fabric
Temporary Works Approval
Approves a temporary structure, support, barrier or arrangement, with who designed it and when it comes down
Written and reviewed by
Siddarth Singh
Founder & Chief Executive Officer, Knowella
Certified Safety Professional and industrial and systems engineer with more than a decade inside food supply chain, freight and manufacturing operations. This page was written against the current text of the standards it cites, not against secondary summaries of them.
- Certified Safety Professional (CSP), Board of Certified Safety Professionals
- MBA, University of Chicago Booth School of Business
- MS and BS, The Ohio State University, Industrial and Systems Engineering
- Six Sigma Black Belt
Sources and last review. Reviewed 16 August 2026 against:
- 29 CFR 1910.38, emergency action plans, including accounting for employees, OSHA
- 21 CFR Part 121, mitigation strategies to protect food against intentional adulteration, FDA
- ISO 45001:2018 clauses 7.3 and 8.2
- ISO/IEC 27001 Annex A.7, physical and environmental security
- BRCGS Food Safety Issue 9 and SQF Edition 9, site security and visitor control
This page is general guidance, not legal advice. Confirm requirements with your jurisdiction’s regulator.